North Korean Hackers Tageting Crypto Experts with KANDYKORN macOS Malware

State-sponsored threat actors from the Democratic People’s Republic of Korea (DPRK) have been uncovered concentrating on blockchain engineers of an unnamed crypto exchange platform by using Discord with a novel macOS malware dubbed KANDYKORN.

Elastic Security Labs reported the exercise, traced again to April 2023, exhibits overlaps with the notorious adversarial collective Lazarus Group, citing an assessment of the network infrastructure and strategies employed.

“Danger actors lured blockchain engineers with a Python software to attain preliminary accessibility to the natural environment,” security scientists Ricardo Ungureanu, Seth Goodwin, and Andrew Pease stated in a report printed now.

“This intrusion included multiple complicated phases that every single employed deliberate protection evasion procedures.”

This is not the initially time the Lazarus Team has leveraged macOS malware in its attacks. Previously this calendar year, the threat actor was noticed distributing a backdoored PDF software that culminated in the deployment of RustBucket, an AppleScript-based backdoor able of retrieving a next-stage payload from a distant server.

What would make the new campaign stand out is the attacker’s impersonation of blockchain engineers on a community Discord server, using social engineering lures to trick victims into downloading and executing a ZIP archive containing destructive code.

“The victim thought they have been installing an arbitrage bot, a software tool capable of profiting from cryptocurrency level variations in between platforms,” the researchers explained. But in truth, the attack chain paved the way for the shipping of KANDYKORN following a five-phase approach.

“KANDYKORN is an innovative implant with a wide variety of capabilities to keep track of, interact with, and prevent detection,” the scientists claimed. “It utilizes reflective loading, a immediate-memory kind of execution that may well bypass detections.”

The starting up position is a Python script (watcher.py), which retrieves an additional Python script (testSpeed.py) hosted on Google Generate. This dropper, for its component, fetches 1 more Python file from a Google Drive URL, named FinderTools.

FinderTools also functions as a dropper, downloading and executing a hidden 2nd phase payload referred to as SUGARLOADER (/Customers/shared/.sld and .log) that finally connects to a remote server in order to retrieve KANDYKORN and execute it instantly in memory.

SUGARLOADER is also accountable for launching a Swift-based self-signed binary acknowledged as HLOADER that attempts to pass off as the legitimate Discord software and executes .log (i.e., SUGARLOADER) to achieve persistence utilizing a method called execution flow hijacking.

KANDYKORN, which is the last-stage payload, is a full-featured memory resident RAT with built-in capabilities to enumerate data files, run added malware, exfiltrate knowledge, terminate processes, and operate arbitrary commands.

“The DPRK, by using units like the LAZARUS Team, proceeds to concentrate on crypto-field firms with the aim of stealing cryptocurrency in purchase to circumvent international sanctions that hinder the progress of their overall economy and ambitions,” the scientists reported.

Kimsuky Resurfaces with Current FastViewer Malware

The disclosure comes as the S2W Threat Examination group uncovered an up to date variant of an Android spy ware called FastViewer that is utilised by a North Korean risk cluster dubbed Kimsuky (aka APT43), a sister hacking outfit of the Lazarus Group.

FastViewer, very first documented by the South Korean cybersecurity firm in October 2022, abuses Android’s accessibility companies to covertly harvest delicate details from compromised products by masquerading itself as seemingly harmless security or e-commerce apps that are propagating by using phishing or smishing.

It is also developed to obtain a 2nd-phase malware named FastSpy, which is dependent on the open-source undertaking AndroSpy, to execute info collecting and exfiltration commands.

“The variant has been in manufacturing given that at the very least July 2023 and, like the preliminary model, is uncovered to induce set up by distributing repackaged APKs that incorporate destructive code in authentic applications,” S2W mentioned.

A person notable aspect of the new version is the integration of FastSpy’s performance into the FastViewer, hence obviating the need to have to down load added malware. That stated, S2W mentioned “there are no known circumstances of this variant currently being distributed in the wild.”

Discovered this post interesting? Stick to us on Twitter  and LinkedIn to read a lot more exclusive content material we post.

Some pieces of this post are sourced from:
thehackernews.com